# CVE-2026-39602: Rustaurius Order Tracking missing authorization in order-tracking

Source: https://junglewise.ai/threats/cve-2026-39602-rustaurius-order-tracking-missing-authorization-in-order-tracking  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-04-08. Updated: 2026-07-24  
License: CC BY 4.0 with a link back

CVE-2026-39602 · Severity: medium · CVSS 5.3 · Published 2026-04-08

The Order Tracking plugin for WordPress, which allows customers to track the status of their orders, contains a security flaw in its access control settings. An unauthorized user could potentially bypass security levels to perform actions they should not be allowed to do, such as modifying order information. This could lead to data integrity issues and disruption of customer service operations.

Vendors: [Etoile Web Design](https://junglewise.ai/threats/vendors/etoile-web-design).

## Quick answers

**Is CVE-2026-39602 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-39602 being exploited in the wild.

**How severe is CVE-2026-39602?** Medium severity, with a CVSS score of 5.3, published 8 April 2026.

**Which products and versions are affected?** Etoile Web Design Order Tracking <= 3.4.3.

**Is there a fix for CVE-2026-39602?** No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.

**How is CVE-2026-39602 attacked?** It is attacked over the network, in a network appliance.

**Am I affected by CVE-2026-39602?** Check whether you run Etoile Web Design Order Tracking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Broken Access Control vulnerability (CWE-862) exists in the Rustaurius Order Tracking plugin (order-tracking) for WordPress through version 3.4.3. The flaw stems from missing authorization checks or incorrectly configured security levels within the plugin's order-tracking functions. An unauthenticated remote attacker can exploit this vulnerability to execute actions that should be restricted to higher-privileged users. While the CVSS score indicates a partial impact on integrity, the vulnerability allows for unauthorized manipulation of plugin-managed data. No official patch was noted in the primary advisory, though users are advised to monitor for updates beyond version 3.4.3.

## Affected products

- Rustaurius (Etoile Web Design) Order Tracking <= 3.4.3

## Timeline

- 2026-01-01: other: Vulnerability reported by researcher Jakub Herman
- 2026-01-31: disclosed: Initial disclosure by Patchstack
- 2026-04-08: advisory: CVE published to NVD

## References

- [https://wordpress.org/plugins](https://wordpress.org/plugins)
- [https://patchstack.com/database/Wordpress/Plugin/order-tracking/vulnerability/wordpress-order-tracking-plugin-3-4-3-broken-access-control-vulnerability?_s_id=cve](https://patchstack.com/database/Wordpress/Plugin/order-tracking/vulnerability/wordpress-order-tracking-plugin-3-4-3-broken-access-control-vulnerability?_s_id=cve)